Question

Difficulty: MediumNetwork and Wireless Attack Indicators

Match each observed network or wireless technical indicator on the left to its corresponding attack classification on the right.

  • Network telemetry exhibiting a high volume of TCP SYN frames originating from a single IP targeting sequential destination ports, accompanied by immediate TCP RST/ACK responses.Port Scanning
  • Capture log exhibiting a flood of unauthenticated 802.11 management frames containing Reason Code 7 sent to client workstations using the MAC address of a legitimate access point.Deauthentication Attack
  • DHCP server logs demonstrating rapid exhaustion of the available IP scope caused by thousands of distinct MAC addresses generated continuously from a single physical switch port.DHCP Starvation
  • Wireless site survey logs revealing an unauthorized access point broadcasting the corporate SSID with a stronger RSSI but configured with mismatched security authentication requirements.Evil Twin

Answer

Port Scanning matches TCP SYN probes across sequential ports. Deauthentication Attack matches 802.11 management frame floods with reason codes. DHCP Starvation matches rapid IP scope exhaustion via MAC address spoofing. Evil Twin matches unauthorized access points spoofing corporate SSIDs with mismatched security settings.
Each attack type exhibits unique packet and log signatures: Port scanning shows systematic connection probes across port ranges; Deauthentication attacks exploit unauthenticated 802.11 management frames; DHCP starvation exhausts IP scopes using spoofed MACs; Evil Twin attacks mimic legitimate wireless SSIDs.

Step-by-Step Solution

1
Analyze indicator left_1
Sequential TCP SYN requests returning TCP RST/ACK indicate active network probing across closed/open ports.
Recognize reconnaissance patterns in TCP traffic.
2
Analyze indicator left_2
802.11 management frames containing reason codes (e.g., Reason Code 7 for Class 3 frame received from nonassociated STA) sent to wireless clients cause immediate disconnects.
Identify wireless denial-of-service indicators at the MAC layer.
3
Analyze indicator left_3
Rapid exhaustion of DHCP leases from spoofed MAC addresses depletes the IP pool.
Identify layer 2/3 protocol resource depletion attacks.
4
Analyze indicator left_4
A rogue AP imitating a legitimate SSID to harvest credentials or conduct on-path attacks represents an Evil Twin setup.
Distinguish between Rogue AP and Evil Twin based on SSID spoofing.

Key Concept

Network and Wireless Attack Indicators
Rate this question